Connect 3CX to a NumberGroup SIP trunk: step-by-step setup

This is the working setup for adding a NumberGroup SIP trunk to 3CX Phone System (v20 / v18). 3CX has built-in templates for common UK carriers — there isn't one for NumberGroup specifically, so we use the Generic template and fill in the standard fields. Takes about 5 minutes once you have your trunk credentials open.

When you ask us to set up the trunk, mention you want the User-Agent Type to "3CX Phonesystem" and Send Numbers As to "International (+xx)" — that presents inbound DDIs in proper E.164 (+44…) which is what 3CX expects internally, so DIDs route automatically.

Step 1: add the trunk in 3CX Admin Console

Log in to the 3CX Admin Console (usually https://yourdomain.3cx.us:5001 or similar).

• Go to SIP Trunks → Add SIP Trunk
• Country: United Kingdom
• Provider: Generic → Generic SIP Trunk
• Enter your main number (the lead DDI you want as Caller ID for outbound)
• Click OK — you'll land on the trunk config screen

Step 2: General tab

• Trunk Name: NumberGroup (or anything memorable)
• Registrar / Server: sip.numbergroup.com
• Outbound Proxy: leave blank
• Number of SIM Calls: set to your trunk channel capacity (Membership default is 25; check the Fraud Detection setting)
• Type of Authentication: Register/Account based
• Authentication ID: T-AAAAAA-NNN from the email we send you (e.g. T-102377-001)
• Authentication Password: your trunk password from the email we send you
• 3 CX Tunnel: No

Step 3: DIDs tab

For each phone number you own with NumberGroup, add it here in E.164 (international) format. NumberGroup's "3CX Phonesystem" User-Agent Type already presents DDIs the way 3CX expects, so all you need is the list of DDIs you own.

• Click Add Single DID
• Enter the number as 441214001262 (no plus, no leading zero)
• Repeat for each number you own
• Hit OK

Step 4: outbound rules

Go to Outbound Rules → Add:

• Rule Name: UK calls via NumberGroup
• Calls to numbers starting with prefix: 0 (so anything dialled with a UK leading 0 goes out the trunk)
• Calls to numbers with a length of: 10 to 14
• Make outbound calls on: select your NumberGroup trunk
• Strip Digits: 1 (drops the leading 0 — needed because NumberGroup expects E.164)
• Prepend: 44
• Set Caller ID to: your main NumberGroup DDI in E.164 (e.g. 441214001262)

For international, add a second rule:

• Prefix: 00
• Strip Digits: 2
• Prepend: nothing
• Same trunk, same CLI

Step 5: inbound rules

Go to Inbound Rules → Add DID Rule:

• Select your trunk and one of the DIDs you added
• During Office Hours: ring an extension, hunt group or ring group
• Outside Office Hours: typically a voicemail box or IVR

Repeat for each DID — common pattern is a single main number → IVR menu, individual DDIs → straight to extensions.

Step 6: verify registration

• Back on the trunk page, the Registered field should switch from Auth to Registered within a few seconds
• We can confirm the trunk has registered our side — ring us or check your email for the "trunk live" confirmation
• Place a test call out, and ring your DDI from a mobile to test inbound

Firewall / NAT

Open outbound on your office firewall:

• UDP 5060 (SIP signalling)
• UDP 9000–10999 (3CX's default RTP range — adjust if you've changed it)

Two NAT gotchas that catch most setups:

• Disable SIP ALG on your router. SIP ALG tries to rewrite SIP headers and almost always breaks something. Look for it under WAN settings.
• 3CX's Firewall Checker (under SIP Trunks) will tell you if STUN, NAT and the local firewall are good. Run it.

When it doesn't work

Trunk shows "Auth" instead of "Registered"

• Wrong Auth ID or password — check it against the email we sent when we set up the trunk
• Wrong registrar — must be sip.numbergroup.com exactly
• Trunk locked to a different IP in Allowed IP or DNS Addresses

Outbound fails with 403 or 488

• 403 → your trunk hasn't registered yet, or the Default CLI you're presenting isn't one of your DDIs. Check Outbound Rules → Caller ID.
• 488 → codec mismatch. 3CX's defaults are fine; if you've changed them, ensure G.711 µ-law (PCMU) and a-law (PCMA) are both offered.

Inbound calls ring but no audio

Classic NAT issue. In 3CX Settings → Network confirm your public IP is detected correctly, and that the SIP ports on your firewall forward to the 3CX server.

Set the fraud caps

Before you go live, configure the trunk's Fraud Detection limits on the trunk:

• Simultaneous Calls: 50–100% higher than your real peak (e.g. you peak at 8, set 12–16)
• Daily Spend: 50–100% higher than your real typical spend (e.g. typical £20/day, set £30–£40)

If a compromised extension tries to dial-through over a weekend, the trunk auto-disables before the bill runs up. See our UK telecom fraud guide for more on what to lock down.

Source: the device navigation in this guide follows 3CX — Configuring a SIP Trunk. We keep the click-path with the manufacturer so it stays current — the NumberGroup trunk values above are the part specific to your account.